At FBI's request, Spain arrests a visiting Russian, Peter Levashov, who infosec experts say is an e-mail spam kingpin known as Peter Severa
And His Massive Botnet Brian Krebs / Krebs on Security : Alleged Spam King Pyotr Levashov Arrested CNN : DOJ plans to disrupt global spam network after Russian hacker's arrest Sheera Frenkel / BuzzFeed : This Russian Hacker's Wife Says He Was Arrested For Being “Linked To Trump's Win” Iain Thomson / The Register : Spanish cops snatch suspected top spammer as US moves against Kelihos botnet BBC : Russian arrested in Spain ‘over mass hacking’ Duncan Riley / SiliconANGLE : Russian man arrested for running notorious spam-sending Kelihos botnet Tech2 : One of the largest botnets in the world is being shut down after US authorities nab alleged owner KTVA-TV : Anchorage FBI, DOJ announce effort to disrupt Kelihos botnet infecting thousands of computers John Eggerton / Broadcasting & Cable : Justice Department Takes Aim at Kelihos Botnet SecurityWeek : US Takes Down Huge Botnet as Spain Arrests Notorious Russian Hacker Dan Goodin / Ars Technica : Feds deliver fatal blow to botnet that menaced world for 7 years Steven Musil / CNET : US targets Kelihos botnet after Russian's arrest in Spain Ionut Arghire / SecurityWeek : Alleged Kelihos Botnet Author Arrested in Spain Gabriela Vatu / Softpedia News : Russian Hacker Arrested in Spain Over Mass Hacking Associated Press : US says global spam scheme targeted after mastermind nabbed Patrick Howell O'Neill / Cyberscoop : DOJ moves to topple Kelihos, one of the world's largest botnets Thomas Fox-Brewster / Forbes : This Russian ‘Cyber Kingpin’ Probably Didn't Hack The US Election Kate Bevan / Naked Security : News in brief: Dallas sirens ‘hacked’; Livejournal cracks down; Russian man arrested in Spain Tweets: Amy Siskind / @amy_siskind : DOJ getting involved in breaking us networks of bots infiltrating US email, logins, etc. THIS IS VERY REAL PEOPLE!!!http://www.justice.gov/ ... @briankrebs : The Justice Dept just released a ton of docs on Peter “Severa” Levashov and his alleged control over Kelihos botnet http://www.justice.gov/... @maddowblog : “The Kelihos virus ... was used during the Russian election in 2012 to send political messages” http://www.nytimes.com/... #Maddow Patrick O'Neill / @howelloneill : Levashov used the same IP addresses to control Kelihos botnet AND to login to stuff like iTunes under his real name http://www.cyberscoop.com/... http://twitter.com/... @mikeisaac : everyone gets caught by something small and stupid in the end http://twitter.com/... Andrew S. Weiss / @andrewsweiss : Backstory on Russian hacker arrested in Spain. Not obvious that there's a tie to US elections via @AndrewKramerNYT http://www.nytimes.com/... @briankrebs : Alleged Russian spam kingpin Pyotr “Severa” Levashov arrested in Spain http://krebsonsecurity.com/... < in operation since 1999.
Context & Ripple Effects
The arrest is the opening move of an FBI operation, not its conclusion: Spanish police detained Levashov on a US warrant while the DOJ announced plans to disrupt the Kelihos botnet he allegedly ran, and infosec researchers — notably Brian Krebs — had already tied him to the 'Peter Severa' handle at the center of the spam economy. His wife's claim that he was seized over 'links to Trump's win' added a political layer to what was, on the record, a botnet case.
The arc closes cleanly: in September 2018, Levashov pleaded guilty in US District Court for his role in Kelihos, validating the cross-border snatch model. That model then scaled well past one man, becoming the template for the infrastructure-level takedowns of 2023–24.
First-order effects
- Levashov shifts from anonymous kingpin to named federal defendant facing extradition and prosecution, while the DOJ's announced disruption leaves Kelihos without its operator.
- Email providers and recipients who bore the brunt of Kelihos-driven spam get immediate operational relief if the disruption proceeds as planned.
Second-order effects
- Suppliers in the criminal spam ecosystem — bulletproof hosts and affiliate networks that rented Kelihos capacity — lose a major customer and learn that 'Peter Severa' style anonymity no longer protects against a US warrant executed abroad.
- Rival botmasters face a higher personal risk calculus: the arrest shows allied police will detain visiting Russians on FBI request, pushing operators toward countries outside extradition reach.
Third-order effects
- The arrest-then-disrupt sequence matures into full multinational infrastructure seizures, culminating in the FBI's infiltration-based Qakbot takedown, the 911 S5 proxy botnet dismantling, and Europol's coordinated ransomware-botnet raids — law enforcement attacking networks, not just their administrators.
- Botnets get reclassified in policy terms from nuisance spam tools to shared attack infrastructure serving ransomware gangs and state-aligned groups like GRU-linked Cadet Blizzard, which raises the diplomatic cost every time Russia objects to extraditions of its nationals.
The trend: Cyber enforcement has shifted from prosecuting individual spammers after the fact to coordinated, pre-planned multinational takedowns of the botnet infrastructure itself.